The first time Thunderbird is run as a particular user - including the Local System account - we get to see the useless "Don't Import Anything" dialog, which causes the lightning install via "-install-global-extension" to fail. We can work around this as follows:

With Mozilla's Network Security Services (NSS) it is also possible to install certificates from the command line. I am not sure if it fits in here since these are not managed per-machine but per-user (or per-profile). See my batch script.